2009 UCLA J.L. & Tech. 1

No Free Lunch (or Wi-Fi): Michigan’s Unconstitutional Computer Crime Statute
by Stacy Nowicki, Ph.D.

I. Introduction

[¶1]Sam Peterson checked his email during his lunch hour, just like other customers at the Re-Union Street Café.1 But Peterson wasn’t a customerÑhe checked his email from his car, parked outside.2 Because Peterson pulled up and sat in his car without getting out, someone from a nearby barber shop suspected he was stalking a hairdresser and called the police.3 Police Chief Andrew Milanowski talked with Peterson, but didn’t charge him right away because he wasn’t sure that Peterson was breaking the law.4 However, after researching a Michigan statute on unauthorized computer access, Milanowski contacted Kent County prosecutors.5 The café’s wireless internet network did not require a password,6 and according to some reports, the café charged patrons a fee to use the internet if they did not order anything.7 Sitting outside, Peterson was using the unsecured wireless network for free.

[¶2]Police arrested Peterson under Michigan’s computer crime statute.8 Michigan law prohibits accessing a computer network to use its services “intentionally and without authorization” or by “exceeding valid authorization.”9 This is a felony punishable by up to five years in prison and a $10,000 fine for citizens without prior convictions, regardless of the amount of loss.10 Because he had no criminal record, Peterson will avoid charges if he pays $400 in fines and completes forty hours of community service.11 Peterson’s seemingly ridiculous predicament caught the attention of national news sources,12 caused a firestorm of controversy on the blog circuit,13 made international news,14 and inspired a satirical exposé on Comedy Central’s The Colbert Report.15 A Maryland state representative even used Peterson’s case to bolster his introduction of a bill that would criminalize intentional wireless internet use in Maryland without permission.16

[¶3]Peterson’s situation reflects the problematic relationship between Michigan’s law and technology, especially the legality of accessing unprotected wireless networks. For instance, many contemporary computing platforms and devices, such as Microsoft Windows XP and iPhones, automatically detect and connect to unsecured wireless internet connections.17 In Peterson’s case, the Re-Union Street Café may have allowed paying customers to use their wireless internet network for free, but charged patrons a fee to use the internet if they did not order anything.18 Regardless, the Café did not put security measures in place to prevent non-customers from accessing the network.19 If piggybacking on an unsecured wireless network like the Café’s is illegal, then Michiganders violate the statute daily through gadgets that connect to open wireless networks without their knowledge or intent.

[¶4]Michigan’s present statute violates the Due Process Clause of the Constitution. It is void for vagueness because the phrase “valid authorization” does not afford citizens fair notice of illegal acts.20 The statute also fails to characterize prohibited conduct because it does not adequately define the meaning of “authorization” or “exceeding valid authorization.”21 This violates Due Process because it enables arbitrary and discriminatory enforcement by police officers and prosecutors.22

[¶5]This Comment examines sections 752.795 and 752.797(6) of Michigan’s computer crime statute in the context of unsecured wireless internet networks and argues that the statute is unconstitutionally void for vagueness.23 Part II gives a background of wireless internet technology, a legislative history of sections 752.791-752.797 of Michigan’s statute, and an overview of the void for vagueness doctrine in constitutional law. Part III focuses on an analysis of sections 752.795 and 752.797(6) in relation to the void for vagueness doctrine. This Part demonstrates how these sections of the statute are unconstitutional because the phrase “valid authorization” does not provide fair notice to the public, and the lack of a definition of “authorization” encourages arbitrary and discriminatory implementation of the statute by law enforcement. Part IV offers solutions for these vagueness problems that would resolve the constitutionality issues, such as defining key terms and excising portions of the statute.

II. Background

A. Overview of Wireless Technology

[¶6]Wireless internet, also known as “Wi-Fi,” uses radio waves to communicate between a computer and a wireless router, which sends the computer’s information to the internet.24 Wireless internet networks use the 802.11 networking standard, a protocol established by the Institute of Electrical and Electronics Engineers (IEEE).25 Various “flavors” of the IEEE 802.11 standard carry data at different speeds and use different parts of the radio spectrum.26 Wi-Fi is distinct from cellular telephone technology, though both use radio signals. A Wi-Fi signal can carry more data than the ones used for cell phones, walkie-talkies, and televisions because it transmits at a higher frequency.27 However, some newer phones can move seamlessly between a cell phone network and a Wi-Fi network.28 These dual-network phones have become popular because entities like libraries and municipalities have made free Wi-Fi networks available to connect the public to the internet.29 Termed “hotspots,” public wireless internet access is also popular in airports, restaurants, hotels, RV parks, cafés, and other hangouts.30 Even cars are now Wi-Fi hotspots; Chrysler recently announced a service called “UConnect” that combines cellular and Wi-Fi technologies to enable internet access in a car and within 100 feet around it.31

[¶7] Though some individuals and organizations intentionally leave their Wi-Fi networks open for anyone to use, others run Wi-Fi networks that are inadvertently unsecured.32 A 2006 Wi-Fi Alliance survey found that, though many Americans believe that securing their home Wi-Fi networks is just as important as locking their windows and doors, nearly thirty percent of home users using wireless networks do not have any security measures in place, leaving their wireless internet networks open for anyone to use. 33 Unfortunately, wireless networks using IEEE 802.11 technology are notoriously insecure.34 Even with some data encryption in place, wireless networks are still vulnerable to hacking to intercept data or modify files.35 Furthermore, the proliferation of public and unsecured Wi-Fi has initiated a movement called “war driving” where individuals drive around businesses and neighborhoods with laptops to find open Wi-Fi networks and even map them for others to use.36

[¶8]Despite concerns about the insecurity of wireless networks, their popularity is high.37 As of December 2006, one-third of internet users in the United States had used the web or checked email via wireless networks;38 of those users, twenty percent had gone online via a wireless network at home, and twenty seven percent have used wireless networks outside of home or their place of employment.39 These statistics demonstrate the pervasiveness of wireless internet use, which will likely continue to grow as more cell phone users discover mobile data services such as internet, text messaging, and email access.

B. Michigan’s Computer Crime Statute

1. Public Act 53 (1979)

[¶9]Michigan was among the first states to create a computer crime statute.40 In 1979, the state legislature passed Public Act 53, which criminalized users accessing a computer or computer network for the purpose of obtaining money, property, or services by fraud.41 Michigan recognized that traditional legal concepts were ill-equipped to deal with crimes perpetrated through technology.42 Like many states, Michigan modeled its statute on the proposed Federal Computer Systems Protection Act of 1977.43 Michigan’s legislature aimed the bill at “ingenious persons who can program a computer to defraud an organization or business and divert information or funds to themselves.”44 Section 752.795 of the Act established that “[a] person shall not intentionally and without authorization, gain access to, alter, damage, or destroy a computer, computer system, or computer network, or gain access to, alter, damage, or destroy a computer software program or data contained in a computer, computer system, or computernetwork.”45

[¶10]A violation of the Act was a misdemeanor if the crime caused damages of $100 or less. If damages exceeded $100, the violation was a felony punishable by up to ten years in prison or a fine up to $5,000 or both.46 The bill passed overwhelmingly in the senate, with only two senators voting against it. Senator Fredericks explained his negative vote in a written protest, stating that “the bill makes it a felony for a person to Ôgain access to’ a computer. What does Ôgain access to’ mean? . . . The potential for abuse of a definition that loose is almost unbounded. The legislature must be vastly more specific before passing legislation of this nature.”47 Legislative analysis of the bill from the Michigan House of Representatives also suggested that the definition of “computer” in the bill might not be thorough enough to cover all computer processing.48 Nonetheless, the house passed the bill unanimously.49

[¶11]Some definitional issues from the 1979 statute remain in Michigan’s current statute. For instance, despite the concerns expressed by Senator Fredericks and the legislative analysis over definitions contained in the bill, the 1979 statute did not define what “without authorization” meant.50 Additionally, though the statute focused on gaining access to a computer for fraudulent purposes, the Michigan Bankers Association expressed apprehension that the 1979 statute criminalized personal use of organizational computers.51 It suggested that the legislature differentiate between major and minor unauthorized use.52 The Association stated:

[¶12]In the computer industry, the unauthorized personal use of computers is an industry-wide operation. Practically every computer programmer or operator runs games, golf league statistics, and other personal projects without express authority of the computer owner. Although the use is forbidden[,] it is tolerated. The association believes that it is not a good idea to make such harmless use a felony with a potential ten-year prison term. A feasible alternative to this concern would be to distinguish between “petty” and “grand” use and provide that the unauthorized use of computer services having a value of less than a specified dollar amount would only be a misdemeanor.53

2. 1996 Revision of the 1979 Act

[¶13]By the mid-1990s, computer hacking was costing businesses millions of dollars,54 federal lawmakers grew more concerned with the use of computers for child pornography,55 and many states either enacted their first computer crime statutes or amended them to reflect the latest crimes.56 Though computer crime had clearly been a problem since the 1970s when states enacted their first computer crime statutes, the personal computer revolution in the 1980s and the advent of the World Wide Web in the 1990s created more fertile ground for computer crimes to flourish.57 In 1996, the Michigan Legislature updated the computer crime statute to address technological advances, the rise of computer hackers, and the increasing number of individuals and businesses using computers.58 Public Act 326 revised section 752.795 and inserted the problematic wording that persists in Michigan’s current computer crime statute (revised wording in italics):

A person shall not intentionally and without authorization or by exceeding valid authorization do any of the following:

(a) Access or cause access to be made to a computer program, computer, computer system, or computer network to acquire, alter, damage, delete, or destroy property or otherwise use the service of a computer program, computer, computer system, or computer network.59

[¶14]The addition of the phrase “exceeding valid authorization” increases the scope of the statute by applying it to authorized users who go beyond their permission to use the system.60 As in the 1979 statute, the 1996 revision does not define “without authorization” or “exceeding valid authorization.” Public Act 326 also inserted the “rebuttable presumption” wording in section 752.797(6):

[¶15]It is a rebuttable presumption in a prosecution for a violation of section 5 that the person did not have authorization from the owner, system operator, or other person who has authority from the owner or system operator to grant permission to access the computer program, computer, computer system, or computer network or has exceeded authorization unless 1 or more of the following circumstances existed at the time of access:

(a) Written or oral permission was granted by the owner, system operator, or other person who has authority from the owner or system operator to grant permission of the accessed computer program, computer, computer system, or computer network.

(b) The accessed computer program, computer, computer system, or computer network had a pre-programmed access procedure that would display a bulletin, command, or other message before access was achieved that a reasonable person would believe identified the computer program, computer, computer system, or computer network as within the public domain.

(c) Access was achieved without the use of a set of instructions, code, or computer program that bypasses, defrauds, or otherwise circumvents the pre-programmed access procedure for the computer program, computer, computer system, or computer network. 61

[¶16]The 1996 revision also created more severe penalties for violating the statute. Instead of requiring damage up to or beyond $100, the 1996 revision formed a complex scheme in section 752.797 that was further tiered and dependent on the amount of loss.62 The legislature further developed the amount of loss to use an “aggregate amount” of direct or indirect loss, which included money, property, or services.63

[¶17]Concerns over the 1996 revision centered on innocent users of the World Wide Web. Under the rebuttable presumption in section 752.797(6), innocent computer users could accidentally blunder into a closed system and “find themselves facing a criminal charge that presumed they were doing something illegally.”64 A Michigan House bill analysis recognized that it could be difficult and costly for the network user to rebut the presumption that he or she had acted unlawfully.65

3. Subsequent Revisions of the 1979 Act

[¶18]In September 2000, Michigan’s attorney general used section 752.795 for the first time, charging two teenagers with hacking.66 The Michigan Legislature had just revised the statute through Public Act 180,67 this time criminalizing unauthorized access to computers without regard to the amount lost.68 Since the 2000 revision changed the law to no longer require $1,000 in damage for the crime to be a felony, one of the teens accused of hacking faced felony charges.69

[¶19]The 2000 revision also narrowed the rebuttable presumption of section 752.797(6) added in 1996 to apply to section 752.795 of the statute only.70 However, these revisions did not address the issue raised in 1996 regarding the rebuttable presumption for the innocent user.71

[¶20]The Michigan legislature introduced two bills in 2007 that further expand the statute. Michigan Senate Bill 144 adds section 752.795(b) and states that a person shall not:

(a) Intentionally and without authorization install or attempt to install spyware into a computer, computer program, computer system, or computer network belonging to another person.

(b) Intentionally and without authorization use or attempt to use spyware that has been installed into a computer, computer program, computer system, or computer network belonging to another person.

(c) Manufacture, sell, or possess spyware with the intent that it be used to violate this act . . . .72

[¶21]This bill prescribes the same penalties as a violation of section 752.795. It also defines “authorized user” as “the owner of a computer, computer program, computer system, or computer network or a person authorized by the owner or the lessee to use the computer, computer program, computer system, or computer network.”73 However, the bill does not define what “authorized” means.

[¶22] At the same time, the legislature introduced Michigan Senate Bill 145, the Spyware Control Act. This bill defines “authorized user” as “the owner of the computer or a person who is authorized by the owner or lessee of the computer to use the computer.”74 However, this bill also does not define what the term “authorized” means.

C. The Void for Vagueness Doctrine

[¶22]The void for vagueness doctrine challenges the language of a law as unconstitutional.75 It originates in the Due Process Clauses of the Fifth and Fourteenth Amendments, which assert that neither federal nor state governments shall deprive any person of “life, liberty, or property, without due process of law.”76 A statute that does not clearly define forbidden behavior violates due process because it does not give the public notice of what activities are prohibited, and law enforcement can enforce the law in an arbitrary and discriminatory way.77 The void for vagueness doctrine requires that statutes contain clear, precise language so they “give the person of ordinary intelligence a reasonable opportunity to know what is prohibited, so that he may act accordingly.”78

[¶23]The vagueness doctrine is often confused with the overbreadth doctrine,79 and the two are related in that they both deal with laws containing imprecise language. However, the overbreadth doctrine differs from the vagueness doctrine because it prevents criminal laws from infringing upon constitutionally protected activity.80 The Supreme Court most often applies the overbreadth doctrine to First Amendment cases, but the Court has applied the doctrine to other constitutional rights as well, such as the freedom of movement and right to vote.81 In contrast, whether a statute prohibits activities that are constitutionally protected is irrelevant to the vagueness doctrine. The central principle of the vagueness doctrine is whether “men of common intelligence must necessarily guess at [a law’s] meaning and differ as to its application.”82

[¶24]The void for vagueness doctrine focuses on two fundamentals: fair notice for citizens and minimal guidelines for law enforcement.83 A statute need not fail both in order to be unconstitutionally vague; a failure of one or the other will suffice.84 The fair notice element exists so that citizens can act in conformity to the law.85 Citizens have a better chance of acting in conformity with the law if they are aware of what conduct is prohibited; otherwise, “the public is more likely to violate the law unwittingly, thereby expanding the pool of potential suspects.”86 Though easy to understand, the fair notice element can be difficult to apply.87 For example, “fair notice” does not imply “actual notice.”88 Publication of a statute without further instruction for the public is always adequate notice, regardless of how difficult the statute is to find.89 Rather, courts have defined “fair notice” in this context to mean “defin[ing] the criminal offense with sufficient definiteness that ordinary people can understand what conduct is prohibited.”90 Furthermore, finding a standard to apply is problematic. Awareness of a statute, knowledge of the law, and life experience vary from person to person.91 Even reliance on the “ordinary person” standard is difficult because the “ordinary person” neither reads statute books nor studies cases interpreting criminal statutes.92 Though ignorance of the law is not an excuse,93 courts do not focus on a particular defendant, but rather ask whether “a person familiar with the statute and its official interpretation would have fair notice.”94

[¶25]Even more important to the vagueness doctrine than the fair notice element is the minimal guidelines element.95 The purpose of the minimal guidelines element is to prevent law enforcement from arbitrarily enforcing statutes and “pursu[ing] their personal predilections.”96 Too much discretion on the part of police and prosecutors can lead to irreparable harm to the wrongly accused.97 Therefore, a statute must “provide explicit standards for those who apply them.”98 How does a legislature know when a law meets the “minimal guidelines” standard? The best guidance the Court provides is that statutes are to include “ascertainable standards of guilt” that are measureable by objective norms.99

[¶26]Furthermore, legislatures must also balance these “minimal guidelines” with factors that necessitate vague language in a statute.100 For example, law enforcement officers must be able to use their judgment to determine how and if to take action in any particular situation,101 and the language of a law must be flexible enough to respond to societal changes, technological advances, and multiple criminal situations.

III. Analysis

[¶27]Sections 752.795 and 752.797(6) of Michigan’s computer crime statute are void for vagueness. The statute fails to communicate which behaviors are permissible and which are prohibited, and it permits the police too much discretion. For example, the phrase “valid authorization” is vague and does not offer the public fair notice, and the term “authorization” is undefined, which encourages arbitrary and discriminatory enforcement.

A. Michigan’s Computer Crime Statute Does Not Give Fair Notice

1. The Phrase “Valid Authorization” is Unclear

[¶28]The rebuttable presumption in section 752.797(6) uses the phrase “exceeded authorization.” Section 752.795, on the other hand, uses the phrase “exceeding valid authorization.” The addition of the phrase “exceeding valid authorization” in section 752.795 suggests that the Michigan Legislature revised the statute to apply to both “outsiders” (unauthorized users who intentionally access a system) as well as “insiders” (authorized users who go beyond their permission to use the system).102 However, legislative history does not reveal why the legislature chose to include the term “valid” in section 752.795, but not section 752.797(6),103 since the legislature revised both sections of the statute at the same time.104

[¶29]This phrase “valid authorization” is vague because there is more than one definition of the word “valid.”105 “Valid” could mean “able to effect or accomplish what is designed or intended” (as in “valid methods”).106 In this sense, “valid authorization” could mean that a password is correct and effective because it is accepted by the system and produces a desired result: the user gains access to a network.107 However, “valid” could also mean “sanctioned,” “justifiable,” or “having legal strength or force” (as in a “valid contract”).108 Interpreted this way, “valid authorization” could mean that the authorization was given by someone who has the authority to do so.109

[¶30]These definitions give different results under the statute. Using the first definition, if “valid authorization” refers to an effective password, then perhaps it does not matter that a password was stolen or used without permissionÑthe mere fact that the password allows access to the system would make it “valid authorization.”110 Two federal court cases interpreting the Digital Millennium Copyright Act of 1998 (DMCA)111 support this reading. In Egilman v. Keller,112 the defendant used “an unauthorized but valid password” to access a computer and website without permission from the plaintiff.113 In deciding whether this was a “circumvention of technological measures” (hacking), the court concluded that “using a username/password combination as intendedÑby entering a valid username and password, albeit without authorizationÑdoes not constitute circumvention under the DMCA.”114 The court in I.M.S. v. Berkshire115 also distinguished between “circumvention” under the DMCA and using a username and password without permission.116 In both of these cases, the defendant’s actions are analogous to stealing a key to open a door rather than picking a lock.117 Therefore, the meaning of the term “valid” in these cases refers to the effectiveness of the username and password in obtaining access to a computer or network.118

[¶31]A user could also exceed valid authorization under this first definition. For example, one person could log on to a network with a password (stolen or not) and allow a second person to access the network. If the network was unsecured, as in Sam Peterson’s case, then “valid authorization” could mean that anyone could access the network without logging in because the Re-Union Street Café’s act of broadcasting an open Wi-Fi signal into the street implied that all access was “valid.”119 In the case of an unsecured network, a user might exceed valid authorization if she used the network too frequently or for too long.

[¶32]Applying the second definition of “valid,” “valid authorization” could refer to permission given by someone who has the power to do so. The issue here is who has the right to authorize permission. For example, if a mid-level manager instructs a data entry technician to access part of a computer network without authority from the company’s CEO, has the data entry technician has exceeded valid authorization? In another scenario, a company’s computer use policy could forbid personal email use on the company’s computers, but a manager allows his staff to do so. It is impossible for the company’s staff to know whether they have valid authorization to use the computers for personal emailÑwho has more authority, the manager or the written policy? Internet service provider (ISP) contracts routinely state that the subscriber may be liable if third parties access a subscriber’s wireless internet network.120 If a café allows customers to use their Wi-Fi, have they given valid authorization to their patrons even though it may violate their ISP contract? Patrick Corbett suggests that determining when a user is “unauthorized” or when an authorized user exceeds “valid authorization” is the duty of a jury.121 However, this does not help network users because they cannot rely on a jury to determine which everyday computer uses comprise valid authorization. Therefore, Michigan’s statute may or may not be violated depending on the meaning each third party gives to “valid authorization” and depending on which third party defines “valid authorization.”

[¶33]Assuming that a network user can determine who has the right to give “valid authorization”, the phrase is still subjective. In United States. v. Williams, the Court elaborated on the kind of language it found objectionable:

[¶34]What renders a statute vague is not the possibility that it will sometimes be difficult to determine whether the incriminating fact it establishes has been proved; but rather the indeterminacy of precisely what that fact is. Thus, we have struck down statutes that tied criminal culpability to whether the defendant’s conduct was “annoying” or “indecent”Ñwholly subjective judgments without statutory definitions, narrowing context, or settled legal meanings.122

[¶35]As in Williams, the phrase “valid authorization” is subjective because a third party, such as the Re-Union Street Café, must clarify what the phrase means.123 Since each third party will have a different standard of “valid authorization,” a user may not know what facts create validity or invalidity. For example, each café offering Wi-Fi may have a different policy that determines under what circumstances non-paying patrons are allowed internet access; none of which may be clear to the person who just wants to check his email.

[¶36]Some contend that words and phrases cannot be defined with absolute certainty.124 Vagueness “does not invalidate every statute which a reviewing court believes could have been drafted with greater precision.”125 The Supreme Court concedes that “[m]any statutes will have some inherent vagueness, since Ô(i)n most English words and phrases there lurk uncertainties.’”126 Furthermore, police must retain the ability make split-second decisions on duty, and prosecutors must maintain their ability to use discretion in order to function effectively.127 However, the Due Process clause only requires that laws give fair warning so citizens can avoid prohibited conduct.128 It is not reasonable to expect the ordinary person to know what behavior is forbidden under sections 752.795 and 752.797(6) because the various ways “valid authorization” can be construed creates confusion and does not enable the members of the public to conform their behaviors to the law.

[¶37] Sam Peterson, who accessed unsecured wireless internet from his car outside the Re-Union Street Café, probably did not violate the statute. Regardless of whether the café charged non-paying customers a fee,129 Peterson accessed the café’s wireless internet connection without hacking into it, and the network did not have security features enabled, such as a password.130 Consequently, a user who accesses an open Wi-Fi network without circumventing security measures could reasonably think he or she has authorization to utilize the network.131 According to section 752.797(6)(c), Peterson is free from the rebuttable presumption that he used the network with authorization because the network was not protected.132

[¶38]Assuming that the Re-Union Street Café did charge non-customers a fee,133 one could argue that Peterson had authorization but exceeded it by using the network without purchasing something from the café or paying the non-customer fee. However, he only broke the law if the café did not consider his authorization valid.134 If network operators have a responsibility to secure their networks as Kern suggests,135 and if ISPs place liability on the subscriber,136 then the café is the party responsible for determining the validity of authorization to use the network. However, Sam Peterson would have had no way of knowing whether the Re-Union Street Café or its ISP considered his authorization valid. The Supreme Court in City of Chicago v. Morales, described an analogous situation in terms of Chicago’s loitering law:

[¶39]The Illinois Supreme Court recognized that the term “loiter” may have a common and accepted meaning, . . . but the definition of that term in this ordinance Ñ“to remain in any one place with no apparent purpose”Ñdoes not. It is difficult to imagine how any citizen of the city of Chicago standing in a public place with a group of people would know if he or she had an “apparent purpose.” . . . [T]he vagueness that dooms this ordinance is not the product of uncertainty about the normal meaning of “loitering,” but rather about what loitering is covered by the ordinance and what is not.137

[¶40]Because of the statute’s vague and subjective terms, Sam Peterson did not have fair notice that his behavior was unlawful. The fact that the police, the café owner, Peterson’s lawyers, and Peterson were all unaware that Peterson’s activities could be prosecuted under Michigan law is further evidence that the law does not provide fair notice of prohibited conduct.138

[¶41]One could argue that the “person of ordinary intelligence”139 would know what “valid authorization” means because word “valid” is in widespread use. However, the phrase “valid authorization” is not common, and ordinary people would not have a shared understanding of its meaning. 140 Additionally, the ordinary person cannot know whether she is or is not presumed to have exceeded authorization under section 752.797(6) since only one section of the statute refers to her authorization as being “valid.” Even if the ordinary person could determine whether the term “valid” applied to 752.797(6), the word “valid” itself is undefined, making it difficult for the ordinary person to know which meaning to apply to the term. Furthermore, the phrase “valid authorization” is not given meaning through context because a computer can be accessed in or out of a workplace, and through a secured or unsecured network.141

[¶42]Michigan’s statute is void for vagueness because the phrase “valid authorization” has two distinct interpretations, is undefined in the statute, has no legal meaning, and is not given any context by the statute. What facts create “valid authorization” are uncertain, and the statute provides no standard to objectively determine validity. Under the statute, a person walking in downtown Lansing, Michigan, whose Wi-Fi cell phone hops from one unsecured wireless internet network to another, may be “exceeding valid authorization” because, though she did not hack into a network, her authorization might not be “valid” to a third party. It is also difficult for computer users to know which third party has the right to establish “valid authorization.” As with the term “authorization,” Michigan’s computer crime statute does not provide examples of criminal conduct or reasonably define how one exceeds “valid authorization.”142 The term “valid” is subjective because a third party such as the Re-Union Street Café must determine what “valid” means. Therefore, citizens do not have fair notice and cannot modify their actions to comply with the law.

B. The Statute Does Not Provide Minimal Guidelines

1. The Statute Allows Too Much Discretion for Law Enforcement

[¶43]Regardless of the fair notice element, section 752.795 of Michigan’s computer crime statute is void for vagueness because it does not establish minimal guidelines for police and prosecutors. The minimal guidelines element exists to prevent arbitrary and discriminatory enforcement.143 According to Morales, a statute may be vague if it “fails to establish standards for the police and public that are sufficient to guard against the arbitrary deprivation of liberty interests.”144 Michigan’s computer crime statute does not include a standard by which law enforcement can determine whether a Wi-Fi user has authorization or has exceeded authorization to use the service. Given that an unauthorized network user who successfully connects to an open Wi-Fi signal is using the service like any authorized user, police cannot ascertain who has authorization or who has exceeded authorization by simple observation. For example, the police only knew Sam Peterson was connected to the Re-Union Street Café’s internet network because he said so.145 Peterson could have been playing solitaire or writing a letter to his mother, neither of which required a network connection. Peterson could also have had internet access on his laptop through a cell phone network or his car;146 neither of which would have been evident or distinguishable from a Wi-Fi connection from the café.

[¶44]Because the only way to discover someone using a Wi-Fi network without authorization is to catch them in the act,147 and because it is not obvious whether a computer user has accessed a Wi-Fi network without authorization, police must use their best guesses as to whether someone is breaking the law. However, this violates the Fourth Amendment because it allows police to arrest Wi-Fi users “for suspected conduct rather than for observable conduct.”148 Many anti-loitering laws have been struck down for the same reason.149 Though an officer who has a reasonable suspicion based on “specific and articulable facts” may conduct a search according to Terry v. Ohio,150 if there are no articulable facts to indicate that a Wi-Fi user is breaking the law and no guidelines in the statute to assist police, then the law may be arbitrarily enforced.

[¶45]Conversely, law enforcement can arbitrarily enforce a vague statute by ignoring certain behavior .151 If a police officer cannot reasonably determine that a Wi-Fi user has accessed the network without authorization, or if the officer is not concerned about a Wi-Fi user’s activities, the officer can decide the law does not apply.152

[¶46]Because the use of a Wi-Fi network without authorization is unobservable, a violation of the statute is indistinguishable from a legal use of a Wi-Fi network. Thus, Michigan’s statute gives the police too much discretion since they can choose to ignore possible violations of the statute or choose to target every laptop user sitting in public places.

2. The Lack of Definition for “Authorization” Encourages Arbitrary Enforcement

[¶47]Few states define “authorization” in their computer crime statues,153 and courts rarely interpret unauthorized access statutes.154 However, the term “authorization” is essential to a computer misuse statute. For example, in Commonwealth v. Cocke, Kentucky’s Court of Appeals held one section of the Kentucky statute outlawing unauthorized computer access void for vagueness because the statute did not distinguish between the authorized and unauthorized altering, damaging, or destroying of data.155 The court stated that “absent a requirement that the actor’s alteration, damage or destruction must occur without authorization, the statute literally permits the prosecution of an authorized user for an alteration as innocuous and innocent as the deletion of an e-mail message.”156 Therefore, it is crucial to include the term “authorization” when appropriate, and necessary to define the term to ensure clarity.157

[¶48]Michigan’s statute does not explicitly define the term “authorization” in section 752.795, but section 752.797(6) uses a rebuttable presumption to indirectly establish meaning. 158 This section states that users are free of the rebuttable presumption that they are unauthorized or have exceeded authorization to use a computer network if: (1) they have written or oral permission by the owner; (2) the computer system tells them it is in the public domain; or (3) they access the computer system without hacking into it.159 However, a rebuttable presumption is not the same as defining “authorized”Ñit only releases defendants from the presumption that they were not authorized without actually identifying a meaning for the term. One can assume that “unauthorized” would mean that one or more of these three conditions did not exist, though this term is not explicitly defined either. The lack of a straightforward definition of “authorization” opens the door for law enforcement to arbitrarily and discriminatorily enforce the statute.160

[¶49]For example, police are likely to use Michigan’s computer crime law to prosecute some crimes and not others. In People v. Golba, the defendant was convicted under section 752.795 of accessing a school computer intentionally and without authorization, or by exceeding “valid authorization” by sending sexually explicit e-mail to a minor student and violating the school’s computer use policy.161 Golba accessed the computer without hacking into it, so he was not presumed to have been “unauthorized” under section 752.797(6)(c).162 The trial court construed Golba’s breach of the school’s terms of computer use as an unauthorized act, and the Michigan Court of Appeals affirmed this decision.163 Along these same lines, a college student who violates her college’s computing terms of use is also guilty under section 752.795 when she downloads a song from a peer to peer file sharing network.164 Both have committed a felony according to the statute,165 but authorities are probably more likely to prosecute the sex offender than the student from an affluent private college because of socioeconomic factors and the seriousness of the crime. 166 Certainly, law enforcement cannot possibly catch every statutory violation, but colleges routinely receive warnings from the Recording Industry Association of America (RIAA) about peer to peer file sharing violations on their campuses,167 so interested prosecutors could easily determine which students are violating the statute. A sex offense may be a more egregious crime, but under the statute the abuse of computing resources is the same regardless of purpose.

[¶50]Some may argue that law enforcement should conserve its resources for the worst offenses, such as sex offenses, rather than expending time and money on less significant illegal acts. However, after Sam Peterson’s arrest, the police staked out the café area to enforce the statute rather than focusing on more substantial crimes. The same police officers that arrested Peterson caught another man outside the Re-Union Street Café using the café’s Wi-Fi from his car.168 The police called the café owner, Donna May. She asked to speak to the man and advised him that “he should tell the police he’d used the café restroom and asked her permission to use her Wi-Fi from his car. The man, in turn, told this to the policeman who was, according to May, rather annoyed and said that they wouldn’t refer such cases to May in future.”169 May never pressed charges against Peterson and apparently was not concerned about the public using her Wi-Fi network.170 However, law enforcement appeared to be concentrating their efforts on one particular kind of network user despite the fact that the network owner was unconcerned about the issue. This situation exemplifies the arbitrary enforcement the vagueness doctrine attempts to eliminate.

[¶51]These scenarios also show that law enforcement cannot reasonably rely on network owners to define “authorization.” First, network owners may not enforce their own policies consistently.171 For instance, a business owner who forgives one employee for breaching the company’s computer use policy may retaliate against a different employee. Furthermore, computer use policies at businesses or educational institutions can be badly written, inconsistent, or nonexistent.172 Some policies use the term “unauthorized” but, like the statute, do not define the word or explain who determines when conduct is authorized.173 In these cases, courts must speculate about what behavior might be authorized by a particular institution and, in the case of a place of business without a policy, who might authorize it. This encourages courts to legislate, promotes inconsistent enforcement of the law, and is evidence that the term “authorization” should be more clearly defined.174

[¶52]Only four Michigan Court of Appeals cases mention this statute,175 and in all four cases the court seems to define authorization in terms of the permissions given to the defendant by the employer.176 In People v. Schilke, No. 253117, 2005 WL 1027039 (Mich. Ct. App. May 3, 2005), the court found the defendant guilty of unauthorized access for accessing her work computer from home after her termination, changing the administrative password, and deleting files.177 In People v. Golba, the defendant sent sexually explicit e-mail to a minor student and violated a school’s policy of unacceptable computer use.178 But in People v. Helleman, the court found the defendant was not unauthorized to access his work computer after he was fired because he was allowed to access his computer without supervision after his termination.179 The employer’s computer use policy, if any, was overridden by the employer’s actions in allowing the defendant to use his work computer after he was fired. In People v. Brunk, the court found the defendant had general authority to access the State’s computer network and authority to retrieve certain files in the course of his employment even though he lacked a work order to do so.180 Here, the employer had no policy stating whether the defendant could or could not act in the way he did.181 These cases demonstrate that a third party’s policies may be unclear, nonexistent, or overridden by its own actions. Therefore, the definition of “authorization” cannot depend on the policies of third parties because this leads to arbitrary enforcement.

[¶53]Michigan’s statute gives too much discretion to law enforcement, and is void for vagueness because it does not explicitly define the term “authorization” or at least give examples of prohibited behavior.182 Law enforcement currently relies on third parties to give meaning to the term “authorization,” because it is not a clear standard for them to follow. The lack of guidelines for determining when one is unauthorized or when one has exceeded authorization to access a computer network creates an opportunity for arbitrary enforcement of the statute.

IV. Solutions

1. Eliminate the Term “Valid”

[¶54] The legislature should eliminate the term “valid” from section 752.795 because it does not add meaning to the term “authorization.” If the phrase “valid authorization” is essential to the statute, then the legislature should define it and give examples of valid authorization directly in the statute.183 However, since the term only appears in section 752.795 and not section 752.797(6), it is unlikely that the legislature would consider it crucial for the interpretation of the statute. Eliminating the word “valid” would solve the fair notice issue in interpreting the statute.

2. Clearly define “Authorization” and “Exceeding Authorization”

[¶55] The legislature should define the terms “authorization” and “exceeding authorization” to discourage arbitrary enforcement of the statute. This definition should also include a reference to third parties that could determine authorization.184 Though many states have statutes that prohibit unauthorized access to computers,185 most have not defined “authorization” or “without authorization”186 However, some have done so sufficiently. For example, North Carolina’s statute defines “authorization” as “having the consent or permission of the owner, or of the person licensed or authorized by the owner to grant consent or permission to access a computer, computer system, or computer network in a manner not exceeding the consent or permission.”187 Unfortunately, the statute does not describe how one would exceed consent or permission. Likewise, Minnesota’s statute simply defines “authorization” as “with the permission of the owner of the computer, computer system, computer network, computer software, or other property.”188 However, the statute refines the definition by allowing the computer owner to limit authorization by “(1) giving the user actual notice orally or in writing; (2) posting a written notice in a prominent location adjacent to the computer being used; or (3) using a notice displayed on or announced by the computer being used.”189

[¶56]Unlike Colorado, North Carolina, and Minnesota, some states incorporate both express and implied consent. In Utah’s statute, “authorization” means “having the express or implied consent or permission of the owner, or of the person authorized by the owner to give consent or permission to access a computer, computer system, or computer network in a manner not exceeding the consent or permission.”190 Similarly, West Virginia (and New Hampshire, with minor modifications) defines “authorization” as “the express or implied consent given by a person to another to access or use said person’s computer, computer network, computer program, computer software, computer system, password, identifying code or personal identification number.”191

[¶57] Other states add a reasonable person standard to include situations the definition might not consider. For example, New Jersey’s statute defines “authorization” as:

[¶58][P]ermission, authority or consent given by a person who possesses lawful authority to grant such permission, authority or consent to another person to access, operate, use, obtain, take, copy, alter, damage or destroy a computer, computer network, computer system, computer equipment, computer software, computer program, computer storage medium, or data. An actor has authorization if a reasonable person would believe that the act was authorized.192

[¶59]This definition also takes into account that the permission, authority, or consent must be lawful.

[¶60] New York’s statute, though not straightforward, has a scienter requirement.193 Its statute defines what it means to be “without authorization”:

[¶61]“Without authorization” means to use or to access a computer, computer service or computer network without the permission of the owner or lessor or someone licensed or privileged by the owner or lessor where such person knew that his or her use or access was without permission or after actual notice to such person that such use or access was without permission. It shall also mean the access of a computer service by a person without permission where such person knew that such access was without permission or after actual notice to such person, that such access was without permission.

[¶62]Proof that such person used or accessed a computer, computer service or computer network through the knowing use of a set of instructions, code or computer program that bypasses, defrauds or otherwise circumvents a security measure installed or used with the user’s authorization on the computer, computer service or computer network shall be presumptive evidence that such person used or accessed such computer, computer service or computer network without authorization.194

[¶63]This kind of definition protects against the user who unwittingly accesses a computer network without authorization.195 Unfortunately, it requires law enforcement to show that the user knew or had notice that her access was without permission.196 This may not deter police from arbitrarily enforcing this statute, since police cannot identify what a user knows unless that user has actual notice. On the other hand, it may deter arbitrary prosecution because it is more difficult to successfully prosecute a crime when law enforcement must prove what a suspect knew.

[¶64]Professor Kerr suggests that these statutes should restrict the scope of “authorization” to code-based circumvention of computer security (hacking) rather than breaches of computer use contracts.197 This allows users to utilize the internet and other computer networks without possible criminal sanctions from breaching “terms of use” contracts.198 According to Kerr, contract law and traditional criminal laws would still apply, but unauthorized computer use laws “would no longer threaten to transform disagreements with computer owners into criminal violations.”199 If applied in Michigan, this would only provide Wi-Fi owners protection from piggybackers who hacked into their network. Wi-Fi network owners would be responsible for protecting their signals with passwords or other security if they did not want them to be publicly available.200 On the other hand, technologies that routinely use unsecured Wi-Fi networks, such as Wi-Fi cell phones, would not violate such a statute. Though some states are moving away from putting the onus on the Wi-Fi network owner,201 as these technologies become more prevalent it makes sense to ensure the law does not criminalize ordinary behavior.202

[¶65]There are several pros and cons to this approach. Two arguments in support of this proposal are: 1) encouraging access to the internet through unsecured Wi-Fi networks increases its value and furthers the public good,203 and 2) Wi-Fi owners can combat piggybacking by closing the network at any time with built-in security measures.204 The internet abounds with free advice on securing Wi-Fi networks,205 and companies that make wireless home routers have step-by-step information available as well.206 On the other hand, an outside party using Wi-Fi resources can compromise network performance for the Wi-Fi network owner and the risk of passing viruses from one computer to another increases.207 Furthermore, the ordinary person may not have the technical expertise to apply security measures to their home or business Wi-Fi network, or just may not take the time to do so.208

[¶66]Another argument in support of making network owners responsible for security is that network owners may rely on laws that protect Wi-Fi networks against unwanted access and they may fail to take appropriate action to secure their network if not encouraged by the law to do so.209 Moreover, some argue that by leaving a network unsecured, a network owner may be signaling that it is acceptable for anyone to use it,210 or that Wi-Fi radio waves encroaching on their property entitles them to use the network.211 Conversely, others contend that this is analogous to leaving a car unlocked with the keys in the ignition or the front door of a house wide open;212 though these situations may facilitate trespass or theft, the owner’s carelessness does not negate the crime. The circumstances are the opposite for Wi-Fi. Because some network owners purposely leave their networks unsecured for others to useÑunlike cars and housesÑthe carelessness of the network owner should negate the crime. Furthermore, security measures for Wi-Fi are turned on once, unlike car or house doors that are routinely locked and unlocked.

[¶67]Another argument against making the Wi-Fi network owner responsible for security is that network users can commit crimes (such as downloading child pornography or sending spam) from open Wi-Fi and it would track to the Wi-Fi owner.213 However, federal legislators have recognized that network owners should not be responsible for the illegal activities of others.214 Some also argue that legislation must protect internet service providers, such as phone and cable companies, from the theft of service that unsecured Wi-Fi can entail.215 But internet service providers may be able to recover under cable television laws, either from subscribers or from manufacturers of wireless routers.216

[¶68]Making access to unsecured Wi-Fi networks presumptively legal “encourages network providers to take responsibility for enabling security mechanisms, mitigates user confusion, and promotes access.”217 It also ensures that the law does not criminalize everyday activities, as more gadgets rely on open Wi-Fi networks for their operations. Until other technologies such as 3G become more commonplace,218 open Wi-Fi is the source for many mobile devices to find and use the internet.

[¶69]Michigan’s legislature should make the use of unsecured Wi-Fi presumptively legal219 and take the best of other states’ definitions to create a clear meaning for both “authorization” and “exceeding authorization.” However, it is necessary to include language defining “exceeding authorized access” in a computer abuse statute to mitigate some of the concerns over a strict code-based definition of access. Though this may seem inconsistent because exceeding access implies a contractual relationship,220 a definition of “exceeding authorized access” expands the statute and gives law enforcement muscle to pursue violations where a user did not hack into the system for initial access.221 Therefore, a definition of “authorization” could read:

[¶70]“Authorization” means express or implied consent or permission of a person who possesses lawful authority to grant such permission, such as a computer or network owner or operator, or of a person approved by the owner to grant consent or permission, to access, operate, use, alter, or destroy said person’s computer program, computer, computer system, or computer network without the use of a set of instructions, code, or computer program that bypasses, defrauds, or otherwise circumvents the pre-programmed access procedure for the computer program, computer, computer system, or computer network. An actor has authorization if a reasonable person would believe that the act was authorized.

[¶71]This definition of “authorization” identifies a person who has lawful authority to grant permission (or her agent), identifies what the authorized user can do and what they can access, specifies that the user cannot hack into the system, and includes a reasonable person standard to catch other scenarios. Similarly, the definition of “exceeding authorized access” could read:

[¶72]“Exceeding authorized access” means to access a computer program, computer, computer system, computer network, or services with authorization and to use such access to obtain or alter information, data, computer programs, computers, computer systems, or computer networks that the person is not entitled to so obtain or alter according to a person who possesses lawful authority to grant such authorization, or of a person approved by the owner to grant authorization. An actor has exceeded authorization if a reasonable person would believe that the act had exceeded authorization.

[¶73]Michigan’s recently introduced bills take a step toward reducing arbitrary enforcement by including explanations of “authorized user,”222 but it is still imperative to incorporate a definition of “authorization” and “exceeding authorization.” This helps solve the arbitrary enforcement issue in interpreting the statute because these definitions provide guidelines for law enforcement, such as identifying a person who has lawful authority to grant permission (or their agent), categorizing what the authorized user can do and what they can access, and specifying that the user cannot hack into the system. By making access to an unsecured Wi-Fi network presumptively legal, law enforcement also does not have responsibility for preventing users from piggybacking on open networks. This would solve the arbitrary enforcement issue.

3. Eliminate Section 752.797(6)

[¶74] The legislature should eliminate the rebuttable presumption in section 752.797(6). This section is problematic for a number of reasons. First, it seems to define “authorization” in a backhanded way, but is ultimately unclear. Second, the rebuttable presumption itself may be unconstitutional because it could violate the constitutional presumption of innocence.223 Therefore, the legislature should eliminate section 752.797(6) altogether and instead amend section 752.792 to include definitions of “authorization” and how one exceeds authorization, as suggested above. Some commentators contend that removing the phrase “rebuttable presumption” and replacing it with the phrase “it may be inferred” converts the mandatory presumption into a constitutionally acceptable permissive inference.224 However, given that the term “authorization” should be defined more clearly anyway, it would be extraneous to preserve the rebuttable presumption in section 752.797(6) in any form.

V. Conclusion

[¶75] Michigan’s current computer crime statute is void for vagueness because it does not define “valid authorization” or the term “authorization” itself. Therefore, the statute should be amended to define key terms and eliminate extraneous language. The vagueness doctrine focuses on two issues: fair notice and arbitrary enforcement of the law.225 The term “valid” is vague because it has multiple meanings. This creates a fair notice issue, since the ordinary person cannot know how it should be interpreted in the statute. This is especially true for unsecured Wi-Fi networks, where users could be violating the statute according to how the term “valid” is defined by third parties. Additionally, the lack of a definition for “authorization” encourages arbitrary and discriminatory enforcement of the statute because there are no guidelines for police and prosecutors that help them enforce the law consistently. Users of unsecured Wi-Fi networks must rely on third parties to determine whether they are “authorized” as well. Simple elimination of extraneous language and rewording the statute to include definitions of “authorization” and “exceeding authorization” clarify the law and eliminate constitutional challenges.

Footnotes